Detecting wireless interlopers

ABSTRACT

In an exemplary apparatus implementation, an apparatus includes: at least one processor; and one or more media including processor-executable instructions that are capable of being executed by the at least one processor, the processor-executable instructions adapted to direct the apparatus to perform actions including: monitoring at least one signal characteristic for multiple signals that relate to a single source address; and detecting a wireless interloper if a discrepancy is determined to exist with regard to the monitored at least one signal characteristic for the multiple signals. In an exemplary access station implementation, an access station is capable of ascertaining at least one signal characteristic for multiple signals, is configured to detect a wireless interloper with regard to a particular address by analyzing the ascertained at least one signal characteristic for the multiple signals, and is adapted to counter the detected wireless interloper.

TECHNICAL FIELD

This disclosure relates in general to address-based wirelesscommunications and in particular, by way of example but not limitation,to detecting and countering interlopers in an address-based wirelesscommunications environment.

BACKGROUND

So-called local area networks (LANs) have been proliferating tofacilitate communication since the 1970s. Certain LANs (e.g., thoseoperating in accordance with IEEE 802.3) have provided enhancedelectronic communication through wired media for decades. Since the late1990s, LANs have expanded into wireless media so that networks may beestablished without necessitating wire connections between or amongvarious network elements. Such LANs may operate in accordance with IEEE802.11 (e.g., 802.11(a), (b), (e), (g), etc.) or other wireless networkstandards. Although standard LAN protocols, such as Ethernet, mayoperate at fairly high speeds with inexpensive connection hardware andmay bring digital networking to almost any computer, wireless LANs canoften achieve the same results more quickly, more easily, and/or at alower cost. Furthermore, wireless LANs provide increased mobility,flexibility, and spontaneity when setting up a network for two or moredevices. However, wireless networks present new and different securityissues due to their ability to be accessed without physical wires anddue to the general openness of wireless media. For example, wirelessLANs are subject to so-called man-in-the-middle (MITM) attacks.

In wireless communication generally, signals are sent from a transmitterto a receiver in the form of packets (e.g., for digital wirelesscommunications). A packet that is traveling from a transmitter to areceiver is vulnerable to interception by a MITM. When packets areintercepted, the MITM can maliciously interfere with the wirelesscommunication to the detriment of the transmitter and/or receiver.

Accordingly, there is a need for schemes and/or techniques to detectand/or counter MITM attacks.

SUMMARY

In an exemplary apparatus implementation, an apparatus includes: atleast one processor; and one or more media includingprocessor-executable instructions that are capable of being executed bythe at least one processor, the processor-executable instructionsadapted to direct the apparatus to perform actions including: monitoringat least one signal characteristic for multiple signals that relate to asingle source address; and detecting a wireless interloper if adiscrepancy is determined to exist with regard to the monitored at leastone signal characteristic for the multiple signals.

In an exemplary access station implementation, an access station iscapable of ascertaining at least one signal characteristic for multiplesignals, is configured to detect a wireless interloper with regard to aparticular address by analyzing the ascertained at least one signalcharacteristic for the multiple signals, and is adapted to counter thedetected wireless interloper.

In an exemplary method implementation, a method includes the actions of:ascertaining multiple respective values for at least one signalcharacteristic for multiple respective packets, each packet of themultiple respective packets corresponding to a particular sourceaddress; and determining if the multiple respective packets originatefrom more than one source responsive to the multiple respective values.

In another exemplary apparatus implementation, an apparatus includes: atleast one processor; and one or more media includingprocessor-executable instructions that are capable of being executed bythe at least one processor, the processor-executable instructionsadapted to direct the apparatus to perform actions including:ascertaining at least one characteristic for a packet having aparticular address; logging the at least one characteristic for thepacket in association with the particular address; determining if abi-modal distribution exists with regard to the particular address; andif a bi-modal distribution is determined to exist, detecting aninterloper with regard to the particular address.

In yet another exemplary apparatus implementation, an apparatusincludes: a signal characteristic ascertainer that is capable ofascertaining values for at least one signal characteristic for receivedpackets having a particular source address; and a discrepancy detectorthat is adapted to detect a discrepancy among the ascertained values forthe at least one signal characteristic for the received packets havingthe particular source address so as to detect a wireless interloper withregard to the particular source address.

Other method, system, apparatus, access station, wireless receiver,media, arrangement, etc. implementations are described herein.

BRIEF DESCRIPTION OF THE DRAWINGS

The same numbers are used throughout the drawings to reference likeand/or corresponding aspects, features, and components.

FIG. 1 is an exemplary general wireless communications environment thatincludes an access station, multiple remote clients, and multiplecommunication links.

FIG. 2 is an exemplary wireless LAN/WAN communications environment thatincludes an access station, a wireless input/output (I/O) unit, anantenna array, and multiple communication beams.

FIG. 3 illustrates an exemplary set of communication beams that emanatefrom an antenna array as shown in FIG. 2.

FIG. 4 illustrates an exemplary wireless communications exchangeinvolving an access station, a remote client, and an interloper thattransceive packets.

FIG. 5 illustrates exemplary signal characteristics for a communicationslink and/or a propagated packet.

FIG. 6 is a flow diagram that illustrates an exemplary method fordetecting a wireless interloper.

FIG. 7 illustrates a wireless communications environment including anexemplary access station that is capable of detecting and countering anattack by a wireless interloper.

FIG. 8 is an exemplary table as shown in FIG. 7 that links addresses tosignal characteristics.

FIG. 9 is a flow diagram that illustrates another exemplary method fordetecting a wireless interloper.

FIG. 10 illustrates an exemplary signal characteristics entry, whichcorresponds to a particular address, for an address-to-signalcharacteristics table as shown in FIG. 8.

FIG. 11 is a flow diagram that illustrates an exemplary method fordetecting and countering a wireless interloper.

DETAILED DESCRIPTION

FIG. 1 is an exemplary general wireless communications environment 100that includes an access station 102, multiple remote clients 104, andmultiple communication links 106. Wireless communications environment100 is representative generally of many different types of wirelesscommunications environments, including but not limited to thosepertaining to wireless local area networks (LANs) or wide area networks(WANs) (e.g., Wi-Fi) technology, cellular technology, trunkingtechnology, and so forth. In wireless communications environment 100,access station 102 is in wireless communication with remote clients104(1), 104(2) . . . 104(n) via wireless communications or communicationlinks 106(1), 106(2) . . . 106(n), respectively. Although not required,access station 102 is typically fixed, and remote clients 104 aretypically mobile. Also, although only three remote clients 104 areshown, access station 102 may be in wireless communication with manysuch remote clients 104.

With respect to a so-called Wi-Fi wireless communications system, forexample, access station 102 and/or remote clients 104 may operate inaccordance with any IEEE 802.11 or similar standard. With respect to acellular system, for example, access station 102 and/or remote clients104 may operate in accordance with any analog or digital standard,including but not limited to those using time division/demand multipleaccess (TDMA), code division multiple access (CDMA), spread spectrum,some combination thereof, or any other such technology.

Access station 102 may be, for example, a nexus point, a trunking radio,a base station, a Wi-Fi switch, an access point, some combination and/orderivative thereof, and so forth. Remote clients 104 may be, forexample, a hand-held device, a desktop or laptop computer, an expansioncard or similar that is coupled to a desktop or laptop computer, apersonal digital assistant (PDA), a mobile phone, a vehicle having awireless communication device, a tablet or hand/palm-sized computer, aportable inventory-related scanning device, any device capable ofprocessing generally, some combination thereof, and so forth. Remoteclients 104 may operate in accordance with any standardized and/orspecialized technology that is compatible with the operation of accessstation 102.

FIG. 2 is an exemplary wireless LAN/WAN communications environment 200that includes an access station 102, a wireless input/output (I/O) unit206, an antenna array 208, and multiple communication beams 202.Wireless LAN/WAN communications environment 200 may operate inaccordance with, for example, a Wi-Fi-compatible or similar standard.Thus, in such an implementation, exemplary access station 102 mayoperate in accordance with a Wi-Fi-compatible or similar standard.Access station 102 is coupled to an Ethernet backbone 204. Accessstation 102 (of FIG. 2) may be considered a Wi-Fi switch, especiallybecause it is illustrated as being directly coupled to Ethernet backbone204 without an intervening external Ethernet router or switch.

Access station 102 includes wireless I/O unit 206. Wireless I/O unit 206includes an antenna array 208 that is implemented as two or moreantennas, and optionally as a phased array of antennas and/or as aso-called smart antenna. Wireless I/O unit 206 is capable oftransmitting and/or receiving (i.e., transceiving) signals (e.g.,wireless communication(s) 106 (of FIG. 1)) via antenna array 208. Thesewireless communication(s) 106 are transmitted to and received from(i.e., transceived with respect to) a remote client 104 (also of FIG.1). These signals may be transceived directionally with respect to oneor more particular communication beams 202.

In wireless communication, signals may be sent from a transmitter to areceiver using electromagnetic waves that emanate from one or moreantennas as focused in one or more desired directions, which contrastswith omni-directional transmission. When the electromagnetic waves arefocused in a desired direction, the pattern formed by theelectromagnetic wave is termed a “beam” or “beam pattern.” Theproduction and/or application of such electromagnetic beams is typicallyreferred to as “beamforming.”

Beamforming may provide a number of benefits such as greater rangeand/or coverage per unit of transmitted power, improved resistance tointerference, increased immunity to the deleterious effects of multipathtransmission signals, and so forth. Beamforming can be achieved usingany of a number of active and passive beamformers (not explicitlyshown). Examples of such active and passive beamformers include a tunedvector modulator (multiplier), a Butler matrix, a Rotman or other lens,a canonical beamformer, a lumped-element beamformer with static orvariable inductors and capacitors, and so forth. Alternatively,communication beams 202 may be formed using full adaptive beamforming.

By using such a beamformer along with antenna array 208, multiplecommunication beams 202(1), 202(2) . . . 202(m) may be produced bywireless I/O unit 206. Although three beams 202(1, 2, m) are illustratedwith three antennas of antenna array 208, it should be understood thatthe multiple antennas of antenna array 208 work in conjunction with eachother to produce the multiple beams 202(1, 2 . . . m). An exemplary setof communication beam patterns is described below with reference to FIG.3.

FIG. 3 illustrates an exemplary set of communication beams 202 thatemanate from an antenna array 208 as shown in FIG. 2. In a describedimplementation, antenna array 208 includes sixteen antennas 208(0, 1 . .. 14, and 15) (not explicitly shown in FIG. 2). From the sixteenantennas 208(0 . . . 15), sixteen different communication beams 202(0),202(1) . . . 202(14), and 202(15) are formed as the wireless signalsemanating from antennas 208 add and subtract from each other duringelectromagnetic propagation.

Communication beams 202(1) . . . 202(15) spread out symmetrically fromthe central communication beam 202(0). The narrowest beam is the centralbeam 202(0), and the beams become wider as they spread outward from thecenter. For example, beam 202(15) is slightly wider than beam 202(0),and beam 202(5) is wider than beam 202(15). Also, beam 202(10) is widerstill than beam 202(5). It should be understood that the set ofcommunication beam patterns illustrated in FIG. 3 are exemplary only andthat other communication beam pattern sets may differ in width, shape,number, angular coverage, and so forth.

Due to real-world effects of the interactions between and among thewireless signals as they emanate from antenna array 208 (e.g., assuminga linear antenna array in a described implementation), communicationbeam 202(8) is degenerate such that its beam pattern is formed on bothsides of antenna array 208. These real-world effects also account forthe increasing widths of the other beams 202(1 . . . 7) and 202(15 . . .9) as they spread outward from central beam 202(0).

In fact, in a described implementation, communication beams 202(7) and202(9) are too wide for efficient and productive use. Hence,communication beams 202(7), 202(8), and 202(9) are not utilized in adescribed implementation; in other words, such an implementationutilizes thirteen communication beams 202 (e.g., beams 202(0 . . . 6)and beams 202(10 . . . 15)). In an alternative implementation, six ofeight communication beams 202(0. . . 8) emanating from an antenna array208 that has eight antenna elements may be utilized.

FIG. 4 illustrates an exemplary wireless communications exchange 400involving an access station 102, a remote client 104, and an interloper402 that transceive packets 404. Each packet 404 is transmitted from afirst entity and received at a second entity (i.e., transceived orexchanged therebetween). Packets 404 are propagated across the wirelessmedium as a wireless communication, a communications link, and/or as acommunications signal.

Each packet 404 includes a source address and a destination address aswell as a payload 406. The source address is intended to identify theentity transmitting packet 404 and the destination address identifiesthe intended recipient. Addresses may identify an entity on a transientbasis or on a permanent basis.

In a described implementation, an address for remote client 104 isassigned on a temporary basis by access station 102, and an address foraccess station 102 is selected for relatively indefinite use. Moreover,the addresses for remote clients 104 may be medium access control (MAC)addresses in accordance with certain IEEE 802.11 provisions. Otherexemplary address types are described below with reference to FIG. 8.The address for access station 102 may be negotiated or otherwise agreedupon by the access station 102 and other access points proximate theretoin certain IEEE 802.11 wireless communication environments.

As illustrated, packet 404(A) has a source address of “RC” (for remoteclient 104) and a destination address of “AS” (for access station 102).Packet 404(A) includes a payload 406(A). Packet 404(A) is successfullytransceived between remote client 104 and access station 102.Conversely, packet 404(B) has a source address of “AS” and a destinationaddress of “RC”. Packet 404(B) includes a payload 406(B). Packet 404(B)is successfully transmitted from access station 102 and received atremote client 104. Thus, packets 404(A) and 404(B) are not hi-jacked,inspected, interfered with, or otherwise impacted by interloper 402.

However, packet 404(C) is impacted by interloper 402. Packet 404(C) hasa source address of “RC” and a destination address of “AS”. Packet404(C) includes a payload 406(C). As illustrated near the bottom ofwireless communications exchange 400, packet 404(C) is transmitted fromremote client 104 and successfully received at access station 102. Asillustrated near the middle of wireless communications exchange 400,packet 404(C) is also intercepted by interloper 402. Althoughillustrated separately, packet 404(C) likely emanates from remote client104 once and from one location.

Interloper 402 (e.g., a MITM) hi-jacks packet 404(C) in the uplinkdirection. For example, interloper 402 retransmits packet 404(C) aspacket 404(D). Packet 404(D) has a source address of “RC” and adestination address of “AS”. Packet 404(D) includes a payload 406(D).Thus, interloper 402 impersonates remote client 104 to spoof accessstation 102 and has the opportunity to modify payload 406(C) to producepayload 406(D), especially if payload 406(C) is not encrypted orotherwise protected. Packet 404(D) is transmitted from interloper 402and received at access station 102.

Interloper 402 may also hi-jack packets 404 in the downlink direction.For example, interloper 402 retransmits packet 404(E) as packet 404(F).Packets 404(E) and 404(F) have a source address of “AS” and adestination address of “RC”. Packet 404(E) includes a payload 406(E),and packet 404(F) includes a payload 406(F). Thus, interloper 402 mayimpersonate access station 102 to spoof remote client 104 and has theopportunity to modify payload 406(E), as well as possibly to blockreception of packet 404(E) by remote client 104.

Packet 404(E) is transceived between access station 102 and interloper402 (because packet 404(E) is intercepted by interloper 402). Packet404(F) is transmitted from interloper 402 and received at remote client104. Although not explicitly shown, packet 404(E) may also be received“directly” from access station 102 at remote client 104 (and thereforein an unmodified form).

Payload 406(D) of packet 404(D) may differ from payload 406(C) of packet404(C). In other words, interloper 402 may hijack the payload 406(C)that remote client 104 is attempting to communicate to access station102, modify it, and then forward the alternative payload 406(D).Similarly, payload 406(F) of packet 404(F) may differ from payload406(E) of packet 404(E).

Various permutations are possible with respect to which packets 404reach which intended destination and at what times. For example, apacket 404 that is sent from remote client 104 toward access station 102may reach only access station 102, only interloper 402, both accessstation 102 and interloper 402, and so forth. Similarly, a packet 404that is sent from access station 102 toward remote client 104 may reachonly remote client 104, only interloper 402, both remote client 104 andinterloper 402, and so forth. Also, packet 404(D) may arrive at accessstation 102 from interloper 402 while packet 404(C) is arriving fromremote client 104, after packet 404(C) has been fully received at accessstation 102, and so forth. Other permutations are additionally possible.

Regardless, because packets 404 from remote client 104 are identified bythe source address, access station 102 cannot automatically detect thatpacket 404(D) is from interloper 402. Furthermore, access station 102may not have the information and/or the capability to detect that packet404(D) is from interloper 402 based on payload 406(D).

As noted above, interloper 402 may impersonate remote client 104 tospoof access station 102, and/or interloper 402 may impersonate accessstation 102 to spoof remote client 104. In the latter case, the address“AS” that is used by interloper 402 may also be the address of an accessstation 102 that has multiple pointing directions (e.g., as establishedby multiple communication beams 202 as shown in FIGS. 2 and 3) and maybe the actual address of an interloping detection mechanism (asdescribed further herein). In other words, an interloping detectionmechanism or a beamforming access device thereof may be the signalsource or communications exchange participant that interloper 402 isimitating

FIG. 5 illustrates exemplary signal characteristics 502 for acommunications link 106 and/or a propagated packet 404. Signalcharacteristics 502 are those characteristics that may be ascertained bya receiver with regard to a signal (e.g., a wireless communication orcommunications link 106, a propagated packet 404, etc.). Signalcharacteristics 502 include, for example, one or more spatial parameters504, a frequency 506, a signal strength 508, etc. with regard to a givensignal.

Frequency 506 corresponds to a frequency at which the signal isreceived, and signal strength 508 corresponds to a signal strength atwhich the signal is received. Both frequency 506 and signal strength 508are somewhat difficult to precisely duplicate as an interloper 402. Anexample for frequency 506 is presented below with particular referenceto FIG. 10.

Spatial parameters 504 can be even more difficult to impersonate as aninterloper 402. Spatial parameters 504 include, for example, a delay510, a direction 512, a multipath (offset) 514, etc. with regard to thegiven signal. Delay 510 corresponds to a delay at which the given signalis received with respect to an expected arrival time. An example fordelay 510 is presented below with particular reference to FIG. 10.

Direction 512 and multipath 514 may be ascertained especially inenvironments with access stations 102 that include wireless I/O units206 that produce multiple communication beams 202. Direction 512 isascertained responsive to on which commication beam 202 of multiplecommunication beams 202(0 . . . m) a signal is received. For example, ifthirteen communication beams 202(0 . . . 13) are receiving signals at anaccess station 102, direction 512 for a given signal may take one ofthirteen values.

Multipath 514 is ascertained responsive to on which communication beam202 of multiple communication beams 202(0 . . . m) a multipath ray orversion of a given signal is received. For example, if thirteencommunication beams 202(0 . . . 13) are receiving signals at an accessstation 102, multipath 514 for a given signal may take one oftwenty-five values depending on which communication beam 202 a multipathray of the given signal is received. With thirteen communication beams202(0 . . . 13) a secondary multipath ray may be +12 to 0 to −12communication beams 202 removed from the communication beam 202 of theprimary ray. Examples for direction 512 and multipath 514 are presentedbelow with particular reference to FIGS. 7 and 10.

FIG. 6 is a flow diagram 600 that illustrates an exemplary method fordetecting a wireless interloper. Flow diagram 600 includes four (4)blocks 602-608. The actions of flow diagram 600 may be performed, forexample, by an access station (e.g., an access station 102 of FIGS. 1,2, 4, etc.), and exemplary explanations of these actions are providedwith reference thereto.

At block 602, signal characteristic(s) of signals that are received andhave a particular address are monitored. For example, one or more signalcharacteristics 502 of wireless communication signals 106 that relate toa single address and that are received at an access station 102 from aremote client 104 (and possibly an interloper 402) may be monitored.

At block 604, it is determined if a discrepancy exists among the signals(including between two signals). For example, it may be determined ifthere is a discrepancy between one or more signal characteristics ofsignal characteristics 502 for multiple signals 106 that relate to asingle address. If no discrepancy is determined to exist (at block 604),then the monitoring is continued at block 606. If, on the other hand, adiscrepancy is determined to exist (at block 604), then an interloper isdetected at block 608. For example, access station 102 may detect aninterloper 402 that is hi-jacking from remote client 104 an addressassigned thereto.

FIG. 7 illustrates a wireless communications environment 700 includingan exemplary access station 102 that is capable of detecting andcountering an attack by a wireless interloper 402. Access station 102produces multiple communication beams 202(1), 202(2), 202(3) . . .202(m) to establish a wireless coverage area (not separatelydesignated). A remote client 104 and interloper 402 are at leastpartially “within” or otherwise “have access to” this wireless coveragearea.

Access station 102 includes antenna array 208 that producescommunication beams 202(1 . . . m) in conjunction with a beamformer (notexplicitly shown in FIG. 7). Access station 102 also includes a signalcharacteristics ascertainer 704, an addresses-characteristics table 706,and a discrepancy detector 708. Signal characteristics ascertainer 704,addresses-characteristics table 706, and/or discrepancy detector 708 maycomprise part of wireless I/O unit 206, for example.

Signal characteristics ascertainer 704 is coupled (directly orindirectly) to antenna array 208 to receive incoming signals. Althoughnot shown, signal characteristics ascertainer 704 may also be part of orcoupled to a beamformer, a signal processor or transceiver, basebandlogic, another receiver path portion, some combination thereof, and soforth. Signal characteristics ascertainer 704 comprises logic toascertain one or more signal characteristics 502 for each signal of thereceived incoming signals.

The ascertained signal characteristics for the incoming signals areforwarded from signal characteristics ascertainer 704 toaddresses-characteristics table 706 for storage in association with thesource addresses of the incoming signals. For example, for each incomingsignal that is received and that relates to a particular source address,the ascertained signal characteristics thereof are stored together inassociation with that particular source address. An exemplaryaddresses-characteristics table 706 is described further below withreference to FIG. 8.

Discrepancy detector 708 analyzes the signal characteristics stored ataddresses-characteristics table 706 for each particular source address.This analysis is performed to determine whether a discrepancy exists inthe stored signal characteristics for a particular source address. Ifso, an attack by a wireless interloper with respect to that particularsource address is detected. Exemplary options for countering the attackby the wireless interloper are described further below both in generaland in the context of wireless communications environment 700.

Wireless communications environment 700 has a coverage area defined bycommunication beams 202(1 . . . m). Within or affecting communicationwithin this coverage area are reflective surfaces 702(A) and 702(B).Reflective surfaces 702 may be cars, buildings, and so forth. Wirelesscommunications within the coverage area may be reflected from thesereflective surfaces 702.

Signals 710 and 712 are being transmitted, received, propagated, and/orreflected within the wireless coverage area. Specifically, remote client104 is transmitting signal 710, and interloper 402 is transmittingsignal 712. Signals 710 and 712 may be comprised of all or part of oneor more packets 404 in a digital wireless communications environment700.

Signal 710 emanates from remote client 104 at a multitude of angles orrays. “Primary” signal ray 710(A) is received by the intendeddestination, which is access station 102, at communication beam 202(2).Signal 710 is also received, or intercepted, by interloper 402 viasignal ray 710(C). Furthermore, signal 710 is also received by accessstation 102 at communication beam 202(1) as a multipath signal ray710(B) that has been reflected off of reflective surface 702(A). Otherun-illustrated signals rays (e.g., from bleedover, multipath, etc.) forsignal 710 may also be present.

In a described example, interloper 402 uses the source address of remoteclient 104, as intercepted from signal ray 710(C), for the signal 712.Signal 712 emanates from interloper 402 at a multitude of angles orrays. “Primary” signal ray 712(A) is received by its intendeddestination, which is access station 102, at communication beam 202(3).Signal 712 is also received by access station 102 at communication beam202(m) as a multipath signal ray 712(B) that has been reflected off ofreflective surface 702(B).

After or while receiving signals 710 and 712 at antenna array 208,signal characteristics ascertainer 704 ascertains one or more signalcharacteristics 502 for each signal. For signal 710, direction 512 isascertained to be communication beam 202(2) (e.g., direction #2) becausesignal ray 710(A) is received thereat. Multipath (offset) 514 isascertained to be one beam 202 removed from the primary beam becausebeam 202(1) of multipath signal ray 710(B) is one beam 202 away frombeam 202(2) that is receiving signal ray 710(A).

For signal 712, direction 512 is ascertained to be communication beam202(3) (e.g., direction #3) because signal ray 712(A) is receivedthereat. Multipath 514 is ascertained to be “k” beams 202 (where k=m-3)removed from the primary beam because beam 202(m) of multipath signalray 712(B) is k beams 202 away from beam 202(3) that is receiving signalray 712(A).

The value of multipath 514 may also be denoted as being positive ornegative, depending on the orientation at which the multipath signal rayis being received with respect to the primary signal ray. For example,multipath 514 for signal 710 may be negative one (−1), and multipath 514for signal 712 may be positive k (+k).

The signal characteristics 502 for each of signals 710 and 712 arestored in addresses-characteristics table 706 in association with asingle source address. Discrepancy detector 708 can then analyze thestored signal characteristics for the single source address. In thisexample, discrepancy detector 708 detects a discrepancy at least betweenthe different directions 512 and multipaths 514 for the single sourceaddress. Thus, discrepancy detector 708 has detected the presence of aninterloper 402.

Discrepancy detector 708 can also take measures to counter interloper402. For example, discrepancy detector 708 is enabled to (i) notify,(ii) record, (iii) terminate a communication, (iv) some combinationthereof, and so forth. Discrepancy detector 708 may notify anadministrator or operator of access station 102 when an interloper isdetected. Discrepancy detector 708 may also record (e.g., relativelypermanently in non-volatile memory) for subsequent further considerationthe signal characteristics 502 for signals 710 and 712 that havedifferent characteristics but the same source address. The payloads 406of packets 404 for signals 710 and 712 may also be recorded.Furthermore, discrepancy detector 708 may terminate the communication ofsignals 710 and 712 that have the single source address.

Although interloper detection and countering is described hereinprimarily in the context of an access station 102, it may alternativelybe implemented by a remote client 104 or any receiver generally that iscapable of ascertaining one or more signal characteristics 502 of agiven signal.

FIG. 8 is an exemplary table 706 as shown in FIG. 7 that links addressesto signal characteristics. In a described implementation,addresses-to-characteristics table 706 includes multiple entries 802(1),802(2) . . . 802(x). Each respective entry 802(1), 802(2) . . . 802(x)corresponds to a respective source address 804(1), 804(2) . . . 804(x).Addresses-to-characteristics table 706 may be realized in memory as anygeneral or specific data structure. Each respective source address804(1), 804(2) . . . 804(x) has stored in association therewithrespective signal characteristics 502(1), 502(2) . . . 502(x). Hence,each entry 802(1), 802(2) . . . 802(x) links a respective source address804(1), 804(2) . . . 804(x) to those signal characteristics 502(1),502(2) . . . 502(x) that have been ascertained from respective signalsreceived with those respective source address 804(1), 804(2) . . .804(x). For example, for each packet 404 that is received having sourceaddress 804(2), the ascertained signal characteristics thereof are addedto signal characteristics 502(2) at entry 802(2).

As noted above, addresses (such as those of a source address 804) maycomprise MAC addresses in accordance with one or more IEEE 802.11standards. Other address type examples include, without limitation, anextended service set identifier (ESSID), an internet protocol (IP)address, and so forth. ESSIDs, for example, may be naturally re-usedwithin a system in a normal deployment mode. In these situations, aninterloping detection mechanism keeps track of the addresses and signalcharacteristics of the devices that are known not to be interlopers, andduplicate (or triplicate, etc.) addresses with new signalcharacteristics are acted upon by the interloping detection mechanism aspotentially originating from interloping devices. For instance, if tworemote clients 104 use the same ESSID during normal operation, and thisinformation along with associated signal characteristics are stored forthe interloping detection mechanism, then the discovery of an ESSID withdifferent signal characteristics may be used to detect an interloper.

FIG. 9 is a flow diagram 900 that illustrates another exemplary methodfor detecting a wireless interloper. Flow diagram 900 includes six (6)blocks 602A, 602B, 604A, 606A, 606B, and 608. The actions of flowdiagram 900 may be performed, for example, by an access station (e.g.,an access station 102 of FIGS. 1, 2, 4, 7, etc. having anaddresses-to-characteristics table 706), and exemplary explanations ofthese actions are provided with reference thereto.

At block 602A, a first packet with a particular address having firstcharacteristic(s) is received. For example, a packet 404 of a signal 710with a source address 804 for remote client 104 may be received havingone or more first signal characteristics 502-1. At block 602B, a secondpacket with the particular address having second characteristic(s) isreceived. For example, a packet 404 of a signal 712 with the sourceaddress 804 of remote client 104 may be received having one or moresecond signal characteristics 502-2.

At block 604A, it is determined if the second characteristic(s) fail tobe commensurate with the first characteristic(s). For example, it maydetermined if second signal characteristics 502-2 fail to becommensurate with first signal characteristics 502-1. It should beunderstood that some deviation in signal characteristics 502 from onepacket 404-1 to another packet 404-2 is to be expected in a wirelesscommunications environment, even if the two different packets 404-1 and404-2 originate from the same transmitter.

If the second characteristic(s) do not fail to be commensurate with thefirst characteristic(s) (as determined at block 604A), then at block606A communications with the particular address continue to bemonitored. At block 606B, additional packets with the particular addressare received and monitored. If, on the other hand, the secondcharacteristic(s) do fail to be commensurate with the firstcharacteristic(s) (as determined at block 604A), then at block 608 aninterloper is detected.

FIG. 10 illustrates an exemplary signal characteristics entry 802(y),which corresponds to a particular address 804(y), for anaddress-to-signal characteristics table 706 as shown in FIG. 8. Signalcharacteristics entry 802(y) corresponds to a source address 804(y).Signal characteristics entry 802(y) includes a vertical axis 1002 thatrepresents the number of packets received that have source address804(y) for any one or more signal characteristics 502.

As illustrated, signal characteristics entry 802(y) includes a frequency506(y), an arrival direction 512(y), an arrival delay 510(y) . . . amultipath offset 514(y). However, each signal characteristics entry 802may include one or more signal characteristics of signal characteristics502 in any combination. Each of the individual signal characteristicshas a corresponding horizontal axis, which represents available valuesfor the individual signal characteristics, and at least one threshold.

In a described implementation, frequency 506(y) has a range of values100 kHz wide in 1 kHz increments. This equates to 100 available valuesor bins to which each packet 404 may be assigned or allocated. Frequency506(y) also has a corresponding threshold 506T. In the illustratedexample, a first packet tally 506(yA) corresponds to bin #3, and asecond packet tally 506(yB) corresponds to bin #5. For frequency 506(y),a bi-modal distribution is present because two packet tallies 506(yA)and 506(yB) exceed threshold 506T.

Arrival direction 512(y) has a range of values that depend on the numberof communication beams 202(0 . . . m). In the illustrated example, m=13,so there are 13 available values or bins to which each packet 404 may beassigned. Arrival direction 512(y) also has a corresponding threshold512T. A first packet tally 512(yA) corresponds to bin #7, and a secondpacket tally 512(yB) corresponds to bin #8. For arrival direction512(y), a bi-modal distribution is present because two packet tallies512(yA) and 512(yB) exceed threshold 512T.

Arrival delay 510(y) has a range of values e.g. 99 nanoseconds wide (orlong) in 1 nanosecond increments. This equates to 99 available values orbins to which each packet 404 may be assigned. Arrival delay 510(y) alsohas a corresponding threshold 510T. A first packet tally 510(yA)corresponds to bin #4, and a second packet tally 510(yB) corresponds tobin #9. For arrival delay 510(y), a bi-modal distribution is not presentbecause only one packet tally 51 0(yA) (of two packet tallies 510(yA)and 510(yB)) exceed threshold 510T.

Multipath offset 514(y) has a range of values across 7 total beamspacings from −3 to +3 in 1 beam increments for multipath rays. Thisequates to 7 available values or bins to which each packet 404 may beassigned. However, 25 different beam spacings, including no beam spacing(0), may alternatively be logged for a system with 13 communicationbeams 202(0 . . . 13). Multipath offset 514(y) also has a correspondingthreshold 514T. A packet tally 514(yA) corresponds to bin #+2. Formultipath offset 514(y), a bi-modal distribution is not present becauseonly one packet tally 514(yA) for one bin has been logged.

As illustrated, threshold 506T is equal to 12 packets, and threshold512T is equal to 10 packets. Also, threshold 510T is equal to 13packets, and threshold 514T is equal to 11 packets. Alternatively, twoor more (including all) thresholds may be set to the same number ofpackets 404.

As indicated above, a bi-modal distribution is considered to be presentfor any given signal characteristic 502 when two different bins are bothfilled to (including beyond) a predetermined threshold. In other words,in a described implementation, an interloper 402 is detected when abi-modal distribution is present for any one or more signalcharacteristics of signal characteristics 502. Alternatively, two,three, or more different signal characteristics may have bi-modaldistributions before an interloper 402 is deemed to be detected.

FIG. 11 is a flow diagram 1100 that illustrates an exemplary method forI detecting and countering a wireless interloper. Flow diagram 1100includes eight (8) blocks 602C, 602D, 602E, 604B, 606C, 608, 1102, and1104. The actions of flow diagram 1100 may be performed, for example, byan access station (e.g., an access station 102 of FIGS. 1, 2, 4, 7, 8,10, etc.), and exemplary explanations of these actions are provided withreference thereto.

At block 602C, a packet is received with a particular address. Forexample, a packet 404 having a source address 804 is received on asignal 710/712 at an access station 102. At block 602D, multiplecharacteristics for the packet are ascertained. For example, a signalcharacteristics ascertainer 704 may ascertain one or more signalcharacteristics 502 of packet 404. At block 602E, the ascertainedmultiple characteristics for the packet are logged. For example, signalcharacteristics 502 for packet 404 may be stored in anaddresses-characteristics table 706 at an entry 802 corresponding tosource address 804.

At block 604B, it is determined if a bi-modal distribution existsresponsive to a predetermined threshold for packets arriving with theparticular address. For example, it may be determined if two differentpacket tallies for at least one signal characteristic 502 exceed apre-selected threshold. If no bi-modal distribution exists (asdetermined at block 604B), an aging policy is applied at block 1102.

An aging policy is used to ensure that packets of the packet tallies aremaintained to be relatively recent. An aging policy may be applied basedon time, based on a number of packets, some combination thereof, and soforth. For example, any packet 404 that was received more than apre-determined period of time in the past may be removed from the binsof a given signal characteristic 502. In other words, a packet filterwith a decaying time constant may be applied to each signalcharacteristics entry 802 of addresses-to-characteristics table 706.

Alternatively, when the number of packets 404 that have been logged inan entry 802 exceeds a predetermined number, then the oldest packet 404is jettisoned. For instance, a packet total for a given signalcharacteristic 502 may be limited to 2.5 times the correspondingthreshold level. After the aging policy is applied (at block 1102),monitoring may be continued at block 606C.

If, on the other hand, a bi-modal distribution does exist responsive tothe predetermined threshold (as determined at block 604B), an interloperis detected at block 608. For example, if a discrepancy detector 708determines that a bi-modal distribution is present at signalcharacteristics entry 802 of addresses-characteristics table 706,discrepancy detector 708 may deem that an interloper 402 has beendetected with regard to the source address 804 corresponding to thatentry 802.

An interloper 402 may be deemed to have been detected under a variety ofsituations. For example, an interloper 402 may be detected when any onesignal characteristic of signal characteristics 502 presents a bi-modaldistribution responsive to the threshold of that signal characteristic.Alternatively, an interloper 402 may be detected when any two, three, ormore signal characteristics of signal characteristics 502 present abi-modal distribution responsive to their respective thresholds.

Certain signal characteristics of signal characteristics 502 may be abetter indicator of an interloper 402 in a particular environment thanother signal characteristics. Consequently, one signal characteristicmay be sufficient alone as an interloper detector while two other signalcharacteristics need to jointly present a bi-modal distribution beforean interloper is deemed to be detected.

Setting the number of signal characteristics that present a bi-modaldistribution before an interloper 402 is deemed to be detected is onescheme for modulating a false alarm rate. Another scheme is changing thethreshold level for an individual or for all signal characteristics ofsignal characteristics 502. Thus, an operator of an access station 102may set a false alarm rate for detecting wireless interlopers.

Yet another scheme for modulating the false alarm rate is requiring abi-modal distribution to be presented twice for a given source address804. Thus, after a bi-modal distribution is determined to exist once fora particular signal characteristic, packet tallies are cleared for thatsignal characteristic (and possibly for all signal characteristics 502for a given source address 804). An interloper 402 is deemed to bedetected if that particular signal characteristic (and possibly anyother signal characteristic of signal characteristics 502) againpresents a bi-modal distribution.

After an interloper is detected (at block 608), the interloper iscountered at block 1104. For example, discrepancy detector 708 (oranother component of access station 102) may (i) notify anadministrator, (ii) record the packet tallies for the bi-modaldistribution signal characteristic or multiple signal characteristics(and possibly payloads 406 of packets 404 as well), (iii) terminatecommunications having the source address 804, and so forth.

These interloper countermeasures may also be employed in a multi-levelapproach. For instance, detection of a first bi-modal distribution maycause a notification and/or a recordation countermeasure to be invoked.After clearing the packet tallies, detection of a second bi-modaldistribution may cause a communication termination countermeasure to beinvoked. Other combinations of interloper detection and countering mayalternatively be employed.

The diagrams of FIGS. 1-11 are illustrated as blocks representingfeatures, devices, logic, components, functions, actions, somecombination thereof, and so forth. However, the order and/or layout inwhich the diagrams are described and/or shown is not intended to beconstrued as a limitation, and any number of the blocks (or portionsthereof) can be combined, augmented, omitted, and/or re-arranged in anyorder to implement one or more methods, systems, apparatuses, accessstations, arrangements, schemes, approaches, etc. for detecting wirelessinterlopers.

Furthermore, although the description herein includes references tospecific hardware-oriented implementations such as those of FIGS. 2, 3,4, 7, 8, and 10 (as well as the exemplary general environment of FIG.1), the features, logic, components, functions, etc. thereof as well asthe actions of FIGS. 6, 9, and 11 can be implemented in any suitablehardware, software, firmware, or combination thereof and using anysuitable coding/logical mechanism(s), address/identificationparadigm(s), radio frequency technology, and so forth.

By way of example only, the blocks of FIGS. 1-11 (e.g., the componentsof FIG. 7 and/or the actions of FIGS. 6, 9, and 11) may be implementedfully or partially as one or more processors and/or as one or moremedia. Such processors may be general purpose microprocessors,special-purpose digital signal processors, some combination thereof, andso forth. Such media may be transmission or storage media, volatile ornon-volatile memory, programmable or hard-wired coding, some combinationthereof, and so forth. Furthermore, the media may includeprocessor-executable instructions that one or more associated processorsare capable of executing.

Although methods, systems, apparatuses, access stations, arrangements,schemes, approaches, and other implementations have been described inlanguage specific to structural and functional features and/or flowdiagrams, it is to be understood that the invention defined in theappended claims is not necessarily limited to the specific features orflow diagrams described. Rather, the specific features and flow diagramsare disclosed as exemplary forms of implementing the claimed invention.

1. An apparatus comprising: at least one processor; and one or moremedia including processor-executable instructions that are capable ofbeing executed by the at least one processor, the processor-executableinstructions adapted to direct the apparatus to perform actionscomprising: monitoring at least one signal characteristic for aplurality of signals that relate to a single source address; anddetecting a wireless interloper if a discrepancy is determined to existwith regard to the monitored at least one signal characteristic for theplurality of signals.
 2. The apparatus as recited in claim 1, whereinthe processor-executable instructions are adapted to cause the apparatusto perform further actions comprising: producing a plurality ofcommunication beams; and receiving the plurality of signals via at leastone communication beam of the plurality of communication beams.
 3. Theapparatus as recited in claim 1, wherein the apparatus comprises anaccess station or a remote client.
 4. The apparatus as recited in claim3, wherein the apparatus further comprises: an antenna array having aplurality of antenna elements; and a beamformer coupled to the antennaarray.
 5. The apparatus as recited in claim 1, wherein the monitoringaction comprises: ascertaining the at least one signal characteristicfor the plurality of signals.
 6. The apparatus as recited in claim 5,wherein the ascertaining action comprises: ascertaining the at least onesignal characteristic as selected from the group comprising: arrivaldelay, arrival direction, multipath offset, signal frequency, and signalstrength.
 7. The apparatus as recited in claim 1, wherein theprocessor-executable instructions are adapted to cause the apparatus toperform a further action comprising: determining if the discrepancyexists with regard to the monitored at least one signal characteristicfor the plurality of signals.
 8. The apparatus as recited in claim 7,wherein the determining action comprises: determining if the monitoredat least one signal characteristic for a first signal of the pluralityof signals fails to be commensurate with the monitored at least onesignal characteristic for a second signal of the plurality of signals.9. The apparatus as recited in claim 7, wherein the determining actioncomprises: determining if a bi-modal distribution exists responsive to apredetermined threshold with regard to the monitored at least one signalcharacteristic for the plurality of signals.
 10. The apparatus asrecited in claim 1, wherein the processor-executable instructions areadapted to cause the apparatus to perform a further action comprising:if a wireless interloper is detected in the detecting action, counteringthe wireless interloper.
 11. The apparatus as recited in claim 1,wherein the monitoring action comprises: receiving a plurality ofpackets having the at least one signal characteristic, each packet ofthe plurality of packets including the single source address.
 12. Theapparatus as recited in claim 1, wherein the detecting action comprises:detecting that two sources exist for the plurality of signals thatrelated to the single source address if a discrepancy is determined toexist with regard to the monitored at least one signal characteristicfor the plurality of signals.
 13. One or more processor-accessible mediacomprising processor-executable instructions that, when executed, directan apparatus to perform actions comprising: ascertaining at least onesignal characteristic for a plurality of signals that relate to a singlesource address; and detecting a wireless interloper if a discrepancy isdetermined to exist with regard to the ascertained at least one signalcharacteristic for the plurality of signals that relate to the singlesource address.
 14. The one or more processor-accessible media asrecited in claim 13, comprising the processor-executable instructionsthat, when executed, direct the apparatus to perform a further actioncomprising: countering a detected wireless interloper.
 15. The one ormore processor-accessible media as recited in claim 14, wherein theaction of countering comprises at least one action selected from thegroup comprising: providing notification of the detected wirelessinterloper; recording the ascertained at least one signal characteristicfor the plurality of signals that relate to the single source address;and terminating one or more communications that relate to the singlesource address.
 16. The one or more processor-accessible media asrecited in claim 13, wherein at least a portion of theprocessor-executable instructions comprise at least part of software fora wireless access station.
 17. An access station that is capable ofascertaining at least one signal characteristic for a plurality ofsignals, that is configured to detect a wireless interloper with regardto a particular address by analyzing the ascertained at least one signalcharacteristic for the plurality of signals, and that is adapted tocounter the detected wireless interloper.
 18. The access station asrecited in claim 17, wherein the access station is further configured todetect a wireless interloper by analyzing the ascertained at least onesignal characteristic for particular signals of the plurality of signalsthat are associated with the particular address.
 19. The access stationas recited in claim 17, wherein the access station is further configuredto detect a wireless interloper by determining that a discrepancy existswith respect to the ascertained at least one signal characteristic forparticular signals of the plurality of signals, wherein the particularsignals are associated with the particular address.
 20. A wirelessreceiver that is configured to perform actions comprising: receiving afirst packet that includes a particular address and has at least onefirst characteristic; receiving a second packet that includes theparticular address and has at least one second characteristic;determining if the at least one first characteristic fails to becommensurate with the at least one second characteristic; and if so,detecting an interloper with respect to packets with the particularaddress.
 21. The wireless receiver as recited in claim 20, wherein thewireless receiver comprises at least one of an access station and aremote client.
 22. The wireless receiver as recited in claim 20, whereinthe wireless receiver is configured to perform a further actioncomprising: if not, continuing to monitor received packets that includethe particular address.
 23. The wireless receiver as recited in claim20, wherein the at least one first characteristic and the at least onesecond characteristic comprise one or more spatial parameters.
 24. Thewireless receiver as recited in claim 23, wherein the one or morespatial parameters comprise at least one of an arrival delay, an arrivaldirection, and a multipath offset.
 25. The wireless receiver as recitedin claim 20, wherein the at least one first characteristic and the atleast one second characteristic comprise one or more signalcharacteristics selected from the group comprising: arrival delay,arrival direction, multipath offset, signal frequency, and signalstrength.
 26. An apparatus comprising: at least one processor; and oneor more media including processor-executable instructions that arecapable of being executed by the at least one processor, theprocessor-executable instructions adapted to direct the apparatus toperform actions comprising: ascertaining at least one characteristic fora packet having a particular address; logging the at least onecharacteristic for the packet in association with the particularaddress; determining if a bi-modal distribution exists with regard tothe particular address; and if a bi-modal distribution is determined toexist, detecting an interloper with regard to the particular address.27. The apparatus as recited in claim 26, wherein theprocessor-executable instructions are adapted to cause the apparatus toperform a further action comprising: receiving the packet having theparticular address via a communication beam of a plurality ofcommunication beams.
 28. The apparatus as recited in claim 26, whereinthe apparatus comprises at least one of an access station and a remoteclient.
 29. The apparatus as recited in claim 26, wherein theascertaining action comprises: ascertaining at least one signalcharacteristic for the packet having the particular address.
 30. Theapparatus as recited in claim 26, wherein the ascertaining actioncomprises: ascertaining at least one of arrival direction and multipathoffset for the packet having the particular address.
 31. The apparatusas recited in claim 26, wherein the ascertaining action comprises:ascertaining the at least one characteristic as selected from the groupcomprising: arrival delay, arrival direction, multipath offset, signalfrequency, and signal strength.
 32. The apparatus as recited in claim26, wherein the ascertaining action comprises: ascertaining a value forthe at least one characteristic for the packet having the particularaddress.
 33. The apparatus as recited in claim 26, wherein the loggingaction comprises: storing the at least one characteristic for the packetat an entry in a table, the entry corresponding to the particularaddress.
 34. The apparatus as recited in claim 26, wherein the loggingaction comprises: increasing a packet tally at an ascertained value ofthe at least one characteristic at an entry corresponding to theparticular address.
 35. The apparatus as recited in claim 26, wherein:the one or more media further includes a table linking assignedaddresses to signal characteristics; and the logging action comprisesstoring the at least one characteristic for the packet at an entry thatcorresponds to the particular address in the table.
 36. The apparatus asrecited in claim 26, wherein the determining action comprises:determining if a bi-modal distribution exists with regard to theparticular address for any signal characteristic.
 37. The apparatus asrecited in claim 26, wherein the determining action comprises:determining if a bi-modal distribution exists with regard to theparticular address responsive to at least one threshold.
 38. Theapparatus as recited in claim 37, wherein the at least one thresholdcomprises a number of packets.
 39. The apparatus as recited in claim 37,wherein the determining action further comprises: determining if twopacket tallies for two different values exceed the at least onethreshold for the at least one characteristic with regard to theparticular address.
 40. The apparatus as recited in claim 26, whereinthe detecting action comprises: clearing the bi-modal distribution thatexists with regard to the particular address; determining if thebi-modal distribution is presented again; and if so, detecting theinterloper with regard to the particular address based on there-presentation of the bi-modal distribution.
 41. The apparatus asrecited in claim 26, wherein the processor-executable instructions areadapted to cause the apparatus to perform further actions comprising:determining if another bi-modal distribution exists with regard to theparticular address; and if both the bi-modal distribution and the otherbi-modal distribution are determined to exist, detecting the interloperwith regard to the particular address.
 42. The apparatus as recited inclaim 26, wherein the processor-executable instructions are adapted tocause the apparatus to perform a further action comprising: applying anaging policy to logged characteristics for packets having the particularaddress.
 43. The apparatus as recited in claim 42, wherein the applyingaction comprises: applying an aging policy to logged characteristics forpackets having the particular address in dependence on a current numberof logged packets.
 44. The apparatus as recited in claim 42, wherein theapplying action comprises: applying an aging policy to loggedcharacteristics for packets having the particular address by employing adecaying time constant.
 45. The apparatus as recited in claim 26,wherein the processor-executable instructions are adapted to cause theapparatus to perform a further action comprising: countering thedetected interloper.
 46. The apparatus as recited in claim 45, whereinthe countering action comprises: providing a notification of thedetected interloper.
 47. The apparatus as recited in claim 45, whereinthe countering action comprises: recording logged characteristics thatare associated with the particular address.
 48. The apparatus as recitedin claim 45, wherein the countering action comprises: recording apayload of the packet having the particular address.
 49. The apparatusas recited in claim 45, wherein the countering action comprises:terminating one or more communications involving packets having theparticular address.
 50. A wireless apparatus that is configured toperform actions comprising: receiving a packet having a particularaddress; increasing a tally for a value for at least one characteristicof the received packet, the tally associated with the particularaddress; determining if tallies for two different values exceed apredetermined threshold, the tallies associated with the particularaddress; and if tallies for two different values are determined toexceed the predetermined threshold, detecting a wireless interloper withregard to the particular address.
 51. The wireless apparatus as recitedin claim 50, wherein the wireless apparatus is configured to perform afurther action comprising: ascertaining the value for the at least onecharacteristic of the received packet.
 52. The wireless apparatus asrecited in claim 50, wherein the apparatus comprises at least one of anaccess station and a remote client.
 53. The wireless apparatus asrecited in claim 50, wherein the at least one characteristic comprisesat least one signal characteristic selected from the group comprising:arrival delay, arrival direction, multipath offset, signal frequency,and signal strength.
 54. The wireless apparatus as recited in claim 50,further comprising: a table having a plurality of entries, each entry ofthe plurality of entries associating an address with one or morecharacteristics; a particular entry of the plurality of entriescorresponding to the particular address, wherein the tally for the valuefor the at least one characteristic of the received packet is stored atthe particular entry.
 55. The wireless apparatus as recited in claim 50,wherein the determining action comprises: determining if a bi-modaldistribution exists with regard to the particular address for the atleast one characteristic.
 56. The wireless apparatus as recited in claim50, wherein the predetermined threshold comprises a number of packets.57. The wireless apparatus as recited in claim 50, wherein the tallyrepresents a plurality of received packets including an oldest receivedpacket of the plurality of received packets; and wherein the wirelessapparatus is configured to perform a further action comprising:decreasing the tally if an age of the oldest received packet exceeds apredetermined period.
 58. The wireless apparatus as recited in claim 50,wherein the wireless apparatus is configured to perform a further actioncomprising: countering the detected wireless interloper.
 59. Thewireless apparatus as recited in claim 58, wherein the countering actioncomprises at least one of: providing a notification of the detectedwireless interloper; recording the two different values for the at leastone characteristic that are associated with the particular address; andterminating one or more communications that involve received packetshaving the particular address.
 60. An arrangement comprising: means formonitoring at least one signal characteristic for a plurality of signalsthat relate to a single source address; and means for detecting awireless interloper if a discrepancy is determined to exist with regardto the monitored at least one signal characteristic for the plurality ofsignals.
 61. The arrangement as recited in claim 60, further comprising:means for producing a plurality of communication beams; and means forreceiving the plurality of signals via at least one communication beamof the plurality of communication beams.
 62. The arrangement as recitedin claim 60, wherein the means for monitoring comprises: means forascertaining the at least one signal characteristic for the plurality ofsignals.
 63. The arrangement as recited in claim 60, further comprising:means for determining if the discrepancy exists with regard to themonitored at least one signal characteristic for the plurality ofsignals.
 64. The arrangement as recited in claim 63, wherein the meansfor determining comprises: means for determining if the monitored atleast one signal characteristic for a first signal of the plurality ofsignals fails to be commensurate with the monitored at least one signalcharacteristic for a second signal of the plurality of signals.
 65. Thearrangement as recited in claim 63, wherein the means for determiningcomprises: means for determining if a bi-modal distribution existsresponsive to a predetermined threshold with regard to the monitored atleast one signal characteristic for the plurality of signals.
 66. Thearrangement as recited in claim 60, further comprising: means forcountering a wireless interloper responsive to the means for detecting.67. The arrangement as recited in claim 60, wherein the means formonitoring comprises: means for receiving a plurality of packets havingthe at least one signal characteristic, each packet of the plurality ofpackets including the single source address.
 68. The arrangement asrecited in claim 60, wherein the means for detecting comprises: meansfor detecting that two sources exist for the plurality of signals thatrelate to the single source address if a discrepancy is determined toexist with regard to the monitored at least one signal characteristicfor the plurality of signals.
 69. A method comprising: ascertaining aplurality of respective values for at least one signal characteristicfor a plurality of respective packets, each packet of the plurality ofrespective packets corresponding to a particular source address; anddetermining if the plurality of respective packets originate from morethan one source responsive to the plurality of respective values. 70.The method as recited in claim 69, further comprising: if the pluralityof respective packets are determined to originate from more than onesource, detecting that a wireless interloper is present with regard tothe particular source address; and countering the detected wirelessinterloper.
 71. The method as recited in claim 69, wherein thedetermining comprises: determining that a discrepancy exists among theplurality of respective values for the at least one signalcharacteristic for the plurality of respective packets.
 72. The methodas recited in claim 69, wherein the determining comprises: determiningthat a first set of values from the plurality of respective values failsto be commensurate with a second set of values from the plurality ofrespective values.
 73. The method as recited in claim 69, wherein thedetermining comprises: determining that a first packet tallycorresponding to a first bin holding at least a portion of the pluralityof respective values and a second packet tally corresponding to a secondbin holding at least a portion of the plurality of respective valuesboth equal or exceed a predetermined threshold for the at least onesignal characteristic.
 74. One or more processor-accessible mediacomprising processor-executable instructions that, when executed, directan apparatus to perform the method as recited in claim
 69. 75. Anapparatus comprising: a signal characteristic ascertainer that iscapable of ascertaining values for at least one signal characteristicfor received packets having a particular source address; and adiscrepancy detector that is adapted to detect a discrepancy among theascertained values for the at least one signal characteristic for thereceived packets having the particular source address so as to detect awireless interloper with regard to the particular source address. 76.The apparatus as recited in claim 75, further comprising: a table havinga plurality of entries, each entry of the plurality of entriescorresponding to a source address and associating values for the atleast one signal characteristic therewith; the associated valuesascertained from received packets having the corresponding sourceaddress.
 77. The apparatus as recited in claim 76, wherein the tableincludes a particular entry that corresponds to the particular sourceaddress, the particular entry associating the ascertained values for theat least one signal characteristic for the received packets with thecorresponding particular source address.
 78. The apparatus as recited inclaim 75, further comprising: an antenna array; a beamformer coupled tothe antenna array; and one or more radio frequency signal processorscoupled to the beamformer; wherein the received packets are provided tothe signal characteristic ascertainer via the antenna array, thebeamformer, and the one or more radio frequency signal processors. 79.The apparatus as recited in claim 75, wherein the discrepancy detectoris configured to implement at least one countermeasure against thedetected wireless interloper.
 80. The apparatus as recited in claim 79,wherein the at least one countermeasure comprises at least one ofnotification, recordation, and communication termination.